Dashboards & Visualizations

all my charts limited to 100 events (Dashboard & Search)

vgtk4431
Path Finder

When plotting a timechart on my SHCluster (just migrated to 8.0.6) it stopped rendering the data after 100 points.

Easy to be seen with a sample request:

 

 

|gentimes start=10/02/2020 increment=1h |eval _time=starttime|timechart count span=1h |streamstats count

 

 

At first I thought it was a new limit included in 8.0.6, but my configuration seems fine :

 

 

## Web.conf jschart parameter :
jschart_results_limit = 10000
jschart_series_limit = 100
jschart_test_mode = False
jschart_truncation_limit.chrome = 50000
jschart_truncation_limit.firefox = 50000
jschart_truncation_limit.ie11 = 50000
jschart_truncation_limit.safari = 50000

 

 

 

 

 

## Vizualisations line parameter :
[line]
allow_user_selection = True
core.charting_type = line
core.height_attribute = display.visualizations.chartHeight
core.icon = chart-line
core.order = 1
core.preview_image = line.png
core.recommend_for = timechart, predict
core.type = visualizations
core.viz_type = charting
data_sources = primary,annotation
data_sources.annotation.params.count = 1000
data_sources.annotation.params.output_mode = json_cols
data_sources.primary.params.count = $display.visualizations.charting.data.count:JSCHART_RESULTS_LIMIT:10000$
data_sources.primary.params.offset = 0
data_sources.primary.params.output_mode = json_cols
data_sources.primary.params.show_metadata = true
default_height = 300
default_width = 300
description = Track values and trends over time.
label = Line Chart
max_height = 10000
min_height = 100
min_width = 100
search_fragment = | timechart count [by comparison_category]
supports_drilldown = True
supports_export = True
supports_trellis = True
trellis_default_height = 400

 

 

 

I understand the precedence order linked to data_sources.primary.params.count

it's taking the charting.data.count value first (from the dashboards) , then the jschart_results_limit then fallback to 10000...

 

image.png

but i'm only in the search app, not in a dashboard, i've no option charting.data.count value so it should be using the jschart_results_limits which is 10000 based on my web.conf

Any ideads on what is happening ? The VERY strange thing is that it's only happening on my shcluster, my utility server is fine...

 

I've the same behavior on all the charting ...

Labels (3)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...